WheelJarA password built here, and only here.
Password generator
Your password
press generate
Built here, in this tab, with the same generator the lottery draws use — nothing is sent anywhere
Weekly lucky numbers
WeeklyA fresh line for the draw you play, every week, with the seed so you can check we did not cherry-pick it.
Try also
What actually makes a password strong?
Password strength is length and an unpredictable source — in that order. Strength is measured
in bits of entropy: the number of guesses an attacker must work through, as a power of two. A
16-character password drawn uniformly from 62 characters is about 95 bits. Adding one more
character adds about 6 bits, which multiplies the work by 64. Swapping an a for an @ adds
almost nothing, because the attacker’s software has known about that substitution since the 1990s.
The source matters just as much and is invisible when it goes wrong: a password made with
Math.random() looks exactly like one from a cryptographic generator and is worthless, because
the sequence can be reconstructed from a handful of outputs. Everything here comes from
crypto.getRandomValues with rejection sampling, so no character is slightly more likely than
another.
The password is built in this tab and never leaves it: there is no server involved, and a generator that sends your password anywhere has defeated its own purpose.
What each length is worth
Letters and digits only, 62 possible characters per position:
| Length | Entropy | Possible passwords |
|---|---|---|
| 8 | 48 bits | 2.2 × 10¹⁴ |
| 12 | 71 bits | 3.2 × 10²¹ |
| 16 | 95 bits | 4.8 × 10²⁸ |
| 20 | 119 bits | 7.0 × 10³⁵ |
| 24 | 143 bits | 1.0 × 10⁴³ |
Each step of four characters multiplies the attacker’s work by about sixteen million. Nothing else you can do to a password comes close to that.
Where the classes actually help
| Setting | Alphabet | Bits per character |
|---|---|---|
| Lower case only | 26 | 4.70 |
| Lower + upper | 52 | 5.70 |
| Lower + upper + digits | 62 | 5.95 |
| All four classes | 76 | 6.25 |
| Digits only (a PIN) | 10 | 3.32 |
A six-digit PIN is 20 bits — a million combinations, which sounds like a lot and is not. It only works because the device locks after a handful of wrong attempts, which is a completely different defence from entropy.
Nearby tools
For a number rather than a string — a random draw, a code, a dice-style value — the random number generator covers any range with or without repeats. For a memorable passphrase built from words instead of characters, the random word generator will give you the words to string together.
Frequently asked questions
How long should a password be?
Sixteen characters is the sensible modern floor for anything that matters, and 20 or more for a password manager’s master password or an email account, since those unlock everything else. Below 12 you are inside the range that well-funded offline cracking reaches, and no amount of punctuation fixes it.
What does entropy in bits mean?
It is the base-2 logarithm of the number of possible passwords your settings can produce. 95 bits means about 2⁹⁵ candidates. Each extra bit doubles the work; each extra character at 62 possibilities adds about 5.95 bits. It is the only strength measure that does not depend on somebody’s opinion.
Should I turn symbols on?
It helps a little — 26 lower, 26 upper and 10 digits is 62 characters, adding symbols takes it to about 76, worth roughly 0.3 bits per character. Length is worth far more. Symbols are mainly useful because some sites demand them, and occasionally because some sites break on them.
What are look-alike characters?
Zero and capital O, one and lowercase l and capital I. With the option on they are left out, which costs about 0.2 bits per character and saves you from typing a password wrong off a screenshot or a printed card. Leave it off when the password only ever gets copied and pasted.
Is the password sent to a server?
No. There is no network request of any kind — the page has already loaded everything it needs before you press generate. You can check by opening your browser’s network tab and pressing the button; nothing appears. That test is worth running on any password generator, not just this one.
Should I use a password manager instead?
Yes, for storing them. A generator solves the making-it part; the hard part is having a different one everywhere and not writing them in a notes file. Most managers generate passwords too — this page is for when you want one outside that flow, or want to see what the entropy actually comes out at.
How the randomness works
crypto.getRandomValues with rejection sampling, which removes the modulo bias that a plain
remainder would introduce. Entropy is reported as length × log₂(alphabet size). Nothing is stored,
logged or transmitted.Worked example
With Length 16, Lower case yes, Upper case yes, Digits yes, Skip look-alikes (0/O, 1/l/I) yes, this page works out press generate. Built here, in this tab, with the same generator the lottery draws use — nothing is sent anywhere
Sources:
Why the strength bar on most sites is wrong
The colour bar on most password forms is theatre. It typically scores the presence of character
classes — a capital, a digit, a symbol — which is why P@ssw0rd1 scores green and correct horse battery staple scores amber, when the second is astronomically stronger. The bar is measuring
compliance with a rule, not resistance to an attack.
Bits of entropy is the measure that survives contact with reality, and it has an uncomfortable implication: a memorable password strong enough for a modern attacker is longer than most people are willing to type. That is the real argument for a password manager. Generate something you will never memorise, store it somewhere that remembers it for you, and spend your memory on the one passphrase that opens the vault.